diff --git a/apisix/core/utils.lua b/apisix/core/utils.lua
index 98e678e0e465..d85f7bb42db1 100644
--- a/apisix/core/utils.lua
+++ b/apisix/core/utils.lua
@@ -18,11 +18,22 @@ local table    = require("apisix.core.table")
 local ngx_re   = require("ngx.re")
 local resolver = require("resty.dns.resolver")
 local ipmatcher= require("resty.ipmatcher")
+local ffi      = require("ffi")
+local base     = require("resty.core.base")
 local open     = io.open
 local math     = math
 local sub_str  = string.sub
 local str_byte = string.byte
 local tonumber = tonumber
+local C        = ffi.C
+local ffi_string = ffi.string
+local get_string_buf = base.get_string_buf
+
+
+ffi.cdef[[
+    int ngx_escape_uri(char *dst, const char *src,
+        size_t size, int type);
+]]
 
 
 local _M = {
@@ -144,4 +155,14 @@ function _M.parse_addr(addr)
 end
 
 
+function _M.uri_safe_encode(uri)
+    local count_escaped = C.ngx_escape_uri(nil, uri, #uri, 0)
+    local len = #uri + 2 * count_escaped
+    local buf = get_string_buf(len)
+    C.ngx_escape_uri(buf, uri, #uri, 0)
+
+    return ffi_string(buf, len)
+end
+
+
 return _M
diff --git a/apisix/plugins/proxy-rewrite.lua b/apisix/plugins/proxy-rewrite.lua
index 70d4cf3bf01f..b65384d88b7c 100644
--- a/apisix/plugins/proxy-rewrite.lua
+++ b/apisix/plugins/proxy-rewrite.lua
@@ -144,6 +144,8 @@ function _M.rewrite(conf, ctx)
         end
     end
 
+    upstream_uri = core.utils.uri_safe_encode(upstream_uri)
+
     if ctx.var.is_args == "?" then
         ctx.var.upstream_uri = upstream_uri .. "?" .. (ctx.var.args or "")
     else